Phishing

Protecting yourself from phishing is the easiest thing in the world. To protect yourself, you only need to know one simple fact:

Never, ever respond to an e-mail such as that described above. If you have any question as to the meaning of the word “Never,” please consult a good dictionary. Don’t even waste your time phoning your bank or other institution to find out whether the e-mail is legitimate. It is not, because Your Financial Institution will Never send you an e-mail asking for this information. I cannot over-emphasize this: if you have any question as to the meaning of the word “Never,” please consult a good dictionary.

Friday, May 21, 2004 — Zachary Keith Hill, 20, was sentenced Tuesday to 46 months in prison after pleading guilty to defrauding America Online Inc. (AOL) and PayPal customers with a sophisticated online phishing con, the U.S. Department of Justice said.

Hill admitted he fraudulently obtained credit card and bank account numbers and defrauded consumers of US$50,000 in two phishing scams. The customers were fooled into providing the information after receiving e-mail messages from Hill containing links to Web pages that harvested personal information. The e-mail looked like official correspondence from the companies.

Such scams proliferate because online criminals, including organized crime groups, enjoy relatively high success rates from phishing crimes, which rarely result in arrest, said Avivah Litan, vice president and research director at Gartner Inc., which recently published a report on phishing.

Most e-mail spam gets only a 1/2 per cent response rate — even if the product that the spammer is selling is legitimate, which it sometimes is. Phishing, however, gets a 3 per cent response rate. That means that 3 per cent of the people who receive these e-mails do not know what you now know—that Your Financial Institution will Never send you an e-mail asking for this information.

Looks pretty real, huh? The “Citigroup Privacy Promise” is a link to an actual Citigroup web page. Likewise the “Terms and Conditions” link. (Grammar nuts will note the misplaced comma after “know,” plus a number of other errors—it doesn’t take a genius to come up with a pretty good phishing scam. Also note the Cyrillic (Russian) character that replaces the copyright symbol ©; the author of this scam was using a Windows® machine that was operating in a language that uses the Cyrillic alphabet, and, like most Windows® users, he didn’t know how to access special characters.) It’s the “click here to access...” link that takes you to the identity theft page. But even if this e-mail had been visually and gramatically perfect, you wouldn’t click that link, because you now know with absolute certainty that this e-mail is an example of phishing, because you now know that Your Financial Institution will Never send you an e-mail asking for this information, and that you should Never respond to such an e-mail.
By now you have also consulted a good dictionary to confirm your understanding of the word “never.”

Here’s another one. By coincidence, this one came in my e-mail as I was preparing this web page. This one isn’t very fancy, and probably made the perpetrator only a few thousand dollars. Again note the improper punctuation. I tried to follow the link to get a screen capture of his data theft form, but the link was no longer working. By now he’s got a new link and a new series of e-mails going around. One would hope that even someone who hadn’t seen the warning on this web page would find it odd that an e-mail that appears to come from usbank.com would refer to the IP address 203.131.68.250 rather than a URL at usbank.com.



	Search Perryopolis.com

	Serving in Uniform
	The Perryopolis Yahoo Discussion Group is at http://www.groups.yahoo.com/group/perryopolis. Join Now!
	Your Privacy on Perryopolis.com
	Internet Security Information
	E-mail the Webmaster
	Try the Large-print Site Index